CVE-2022-23256: Azure Data Explorer Spoofing Vulnerability

Overview

Severity
High (CVSS 8.1)
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
Category
Spoofing
Exploit Status
Not Exploited
Exploitation Likelihood
Less Likely
Patch Tuesday
2022-Feb
Released
2022-02-08
EPSS Score
4.12% (percentile: 88.6%)

FAQ

According to the CVSS metric, successful exploitation of this vulnerability could lead to total loss of confidentiality (C:H)? What does that mean for this vulnerability? This vulnerability discloses a user's JSON web token to the attacker. According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do? The user would have to click on a specially crafted URL to be compromised by the attacker. How do I get the security update for Azure Data Explorer? You need to restart the Kusto.Explorer application. The update will be automatically downloaded. Where can I find information about the update? Release notes for the update are available in the application menu under Help->What’s new, under the applicable Version. According to the CVSS metric, successful exploitation of this vulnerability could lead to total loss of integrity (I:H)? What does that mean for this vulnerability? The compromised JSON web token can be used to compromise accounts and modify account information.

Affected Products (1)

Azure

  • Azure Data Explorer

Revision History

  • 2022-02-08: Information published.